HijackDat — scripted parody scan and dialogs

These are the fictional log entries and scripted messages used by the desktop parody.

Scan log

R0 - HKCU\Software\MuriCaSoft\InfoSurfer\Main,Start Page = http://www.muricaweb.net
R1 - HKCU\Software\MuriCaSoft\InfoSurfer\Main,Search Page = http://search.muricaweb.net
R3 - Default URLSearchHook is missing
O2 - BHO: YourWay Search Assistant - {3F0C-AFF1-1337-DEAD} - C:\PROGRA~1\YOURWAY\srchbar.dll
O2 - BHO: NeatWebFind Toolbar Helper - {4E2A-DEAD-BEEF-1234} - C:\Doors\System\nwfsrch.dll
O4 - HKLM\..\Run: [ChumChimp] C:\Program Files\ChumChimp\chimpassist.exe
O4 - HKLM\..\Run: [Snoozer] C:\Program Files\Snoozer\snoozer.exe -systray
O4 - HKLM\..\Run: [BassJamb] C:\Program Files\BassJamb\bjamb.exe
O4 - HKLM\..\Run: [MuricaOnline] C:\Program Files\MuricaOnline\mol.exe
O4 - HKLM\..\Run: [StarPointer] C:\Doors\System\starpnt.exe /startup
O4 - STARTUP: ChumChimp.lnk = C:\Program Files\ChumChimp\chimpassist.exe
O10 - DoorSock hijack by WhileU: C:\Doors\System\whileu.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{A7BE-9C2D}: NameServer = 69.42.0.1
O18 - Protocol: muricaweb - {1D2E-3F4A-5B6C-7D8E} - C:\PROGRA~1\MURICA~1\murica.dll
O23 - Service: Download More RAM Helper (dlmore) - Unknown owner - C:\Doors\System\dlmore.exe
O23 - Service: WhileU Scheduler (wusched) - Unknown owner - C:\Program Files\WhileU\wusched.exe
O23 - Service: StarPointer Cursor Driver (starpnt) - Unknown owner - C:\Doors\System\starpnt.sys

Scan messages

  1. Initializing HijackDat v1.99.1...
  2. Scanning C:\Doors\System...
  3. Checking Browser Helper Objects...
  4. Scanning HKLM\SOFTWARE...
  5. Analyzing running processes...
  6. Scanning C:\Doors\Temp...
  7. Checking startup entries...
  8. Scanning downloaded program files...
  9. Analyzing hosts file for modifications...
  10. Checking DoorSock providers...
  11. Scanning C:\Program Files...
  12. Cross-referencing threat signatures...
  13. Finalizing...

Confirmation dialogs

  1. Are you sure you want to fix the checked items?
  2. This action cannot be undone. Continue?
  3. Warning: Fixing these items may affect your internet experience. Proceed?
  4. Some of these programs may be required for normal system operation. Continue anyway?
  5. Removing these items will require a system restart. Proceed?
  6. ChumChimp will be removed. He will be very lonely. Continue?
  7. Snoozer currently has 14,000 songs queued. Proceed with removal?
  8. YourWay Search has learned your browsing preferences over 847 sessions. Delete this data?
  9. Are you really sure?
  10. This is your absolute last chance to cancel.
  11. Okay but like, are you SURE sure?
  12. Have you considered that muricaweb.net is actually a great homepage?
  13. StarPointer makes your cursor a shooting star. You want to delete a shooting star?
  14. BassJamb is currently playing 'All Star'. Stop playback to continue?
  15. WhileU Scheduler has a great deal queued for you in 3 minutes. Cancel that deal?
  16. Download More RAM Helper has freed 47MB of RAM since last Tuesday. Remove it?
  17. Are you even still reading these?
  18. NeatWebFind found 12 great deals on carpet cleaning near you. Dismiss these deals?
  19. WARNING: Removing these items may cause Doors to become more stable.
  20. That sounds bad actually. Reconsider?
  21. NOTICE: Your IP address has been logged.
  22. Just kidding. Or have we?
  23. Proceeding will void your warranty.
  24. You don't have a warranty.
  25. 25 of 50 confirmations complete. You're halfway there!
  26. Have you tried restarting instead?
  27. ChumChimp says: 'Please don't go.'
  28. Snoozer is currently seeding 4 files to 1,337 peers. Interrupt this?
  29. MuricaOnline has been your ISP for 9 years. Think of the memories.
  30. Your free trial of NeatWebFind expires in 0 days. Renew now?
  31. No? Okay.
  32. Fine.
  33. FINE.
  34. We just want you to know we are very disappointed.
  35. YourWay Search wanted to say goodbye.
  36. ChumChimp has left the building.
  37. We have informed muricaweb.net of your decision.
  38. They said 'whatever.'
  39. WhileU wanted to tell you about one last deal.
  40. A really good one.
  41. Like, genuinely outstanding.
  42. Fine, we will not tell you.
  43. You will regret this.
  44. We mean that sincerely.
  45. Okay we are almost done.
  46. Almost.
  47. ALMOST.
  48. fine
  49. Reboot required to complete removal. Click OK to reboot.